CVE-2026-49837 is a medium-severity (CVSS 5.9) Out-of-bounds Read vulnerability in github.com/osrg/gobgp/v4. A fix is available for github.com/osrg/gobgp/v4 — see the affected versions and patch details below.
GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-49837.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-49837 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 395,249 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
github.com/osrg/gobgp/v4Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
GoBGP contains a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`.
A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment.
Details
The issue is in the BGP OPEN capability parser under:
pkg/packet/bgp/bgp.gopkg/packet/bgp/validate.go
The BGP OPEN optional parameter capability format includes a capability code, a capability length field, and a capability value. Each concrete capability decoder should only parse bytes inside the declared capability value boundary.
In affected versions, the generic capability parser records the declared CapLen, but several concrete capability decoders continue parsing from the full remaining capability buffer after advancing past the two-byte capability header. Conceptually, the vulnerable pattern is:
data = data[2:]
// decoder reads from data without first limiting it to CapLen
### PoC
The following parser-level proof of concept demonstrates the issue without requiring a full BGP session or a running `bgpd` instance.
The malformed capability uses:
- Capability Code: `65` (`BGP_CAP_FOUR_OCTET_AS_NUMBER`)
- Declared `CapLen`: `0`
- Four following bytes: `00 00 fd e8`
Although the capability declares an empty value, affected versions parse the following four bytes as the 4-octet AS value `65000`.
### Impact
A remote peer that can send a malformed BGP OPEN message to a GoBGP instance may cause capability values to be parsed from outside their declared `CapLen` boundaries.
In the 4-octet AS capability case, this may affect:
- peer AS validation;
- capability negotiation;
- interpretation of malformed OPEN messages;
- acceptance or rejection decisions during BGP session establishment.
This issue does not appear to be arbitrary memory corruption, remote code execution, or information disclosure. It is a protocol parser boundary validation issue that can affect BGP OPEN validation semantics.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/osrg/gobgp/v4 | all versions | 4.6.0go get github.com/osrg/gobgp/v4@v4.6.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/osrg/gobgp/v4, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/osrg/gobgp/v4 to 4.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-49837 is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.
Frequently Asked Questions
Is CVE-2026-49837 in your dependencies?
Find it across Go, including transitive dependencies.